GitHub Advisoryadvisory · Go

GHSA-pw7p-7fqv-hpj8 GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function

HIGH Published 2026-06-03 Modified 2026-07-13 Official page ↗
Aliases
CVE-2026-37462
Ecosystem
Go
Packages
github.com/osrg/gobgp/v4
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-190
Reviewed
2026-07-13

Affected packages

• Go github.com/osrg/gobgp/v4: < 4.4.0 → fixed in 4.4.0

Description

An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Related

Alias · CVE (1)

  • CVE-2026-37462 An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service… vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References